Phishing & spear phishing simulations for your IT security

Are your employees and processes phishing-resistant? Our simulations reveal exactly where your staff, reporting processes, and technical safeguards really stand – before a real attacker finds out.

Illustration: 3 Personen und Hund in relaxter Bürosituation, davor Ritter, der mit Schild einen Drachen abwehrt.

The attack doesn't test your firewall. It tests your inbox.

AI makes phishing emails nearly indistinguishable from legitimate messages today. Even the most advanced security solutions reach their limits when human error is exploited – according to the BSI , one in three unwanted emails is a phishing email. Among the most active ransomware groups currently targeting German companies, clicking a phishing link is one of the most common entry points. Without clear reporting processes, a single click can quickly escalate into a company-wide incident. This is exactly where our phishing simulations come in: realistic attacks, real reactions, honest results.

The most common phishing methods at a glance

Email phishing

The classic: fake senders, malicious links, dangerous attachments. Targets everyone, hits often.

Spear phishing

Highly targeted, with personalized messages tailored to the individual recipient.

Whaling

Spear phishing aimed at executives. When the CEO clicks, the damage is usually the greatest.

Quishing

Phishing via QR code, placed on posters, delivery notes, or fake parking meters. Mobile devices are often less protected than company laptops.

Vishing

The call from the supposed IT support team urgently needing your password. Phone calls bypass email filters.

Smishing

SMS messages with fake package tracking links or bank alerts. Short, urgent, and landing on personal phones.

Spear phishing – when attackers know you personally

Mass phishing targets many people at once. The message is generic, the context interchangeable. Spear phishing is the opposite: a message so specifically tailored to a person or situation that it's barely recognizable as an attack.

Know your enemy: an attacker who knows your CFO is currently negotiating an acquisition doesn't need malware. A fake email with an "urgent payment approval" is enough. That's Business Email Compromise (BEC) – one of the most costly phishing variants out there.

Our spear phishing simulations start where attackers do: with Open Source Intelligence (OSINT). We collect the same information a real attacker would find and test whether your team falls for it.

How prepared is your team against phishing?

Let's find out together – in a controlled, safe environment with clear results.

The benefits of our phishing simulations

Realistic risk assessment

You can see in black and white just how vulnerable your team effectifely is in everyday work situations.

Analysis icon: Magnifying glass, with a diagram line enlarged in it

Uncover technical gaps

We test whether your spam filters, mail gateways, and security systems hold up under real-world conditions.

Better reporting and response processes

Do you know what happens when someone clicks? We show you where your reporting processes break down and how to fix them.

Measurable security progress

Get concrete metrics on the development of security awareness across your organization.

Lasting learning effect

Repeated phishing campaigns reinforce secure behavior. So "oh, I almost clicked that" becomes second nature.

We make your organization more resilient against phishing

Antonia Schmalstieg

IT-Security Consultant

Phishing is still underestimated in many security strategies. Security awareness often remains untapped potential, and clear reporting and response processes for suspicious emails are missing in many organizations. This is exactly where we come in: we make that potential visible and build on it deliberately.

Antonia Schmalstieg

IT-Security Consultant

How a phishing campaign works

Step 1 – Scoping

We'll work with you to define the parameters: the target audience, scope, and specific goals of your phishing campaign.

Step 2 – Execution

We'll carry out the campaign, send out the simulated phishing emails, and continuously monitor its progress.

Step 3 – Analysis

You'll receive a detailed analysis showing how your employees responded and where the weaknesses lie.

Step 4 – Recommendations

We develop specific recommendations for action and show you targeted measures to sustainably improve your IT security.

Frequently asked questions about phishing

How does spear-phishing differ from mass phishing?

Spear-phishing is a targeted form of phishing in which attackers approach specific individuals or organizations personally. Unlike mass phishing, it leverages personal information such as job title or current projects to make the message appear credible. This information is typically gathered from publicly available sources.

What is a phishing simulation?

A phishing simulation is a controlled, safe attack test in which realistic phishing emails are sent to employees. The goal is to train staff to recognize attacks and strengthen overall security awareness.

Why are phishing tests important for companies?

Phishing is one of the most common attack vectors in IT security. Simulations help identify and sustainably improve human, technical, and organizational weaknesses.

What are common phishing methods?

Email phishing, spear phishing, whaling, smishing, vishing, and quishing.

Are simulated phishing attacks dangerous for employees?

No. These are fully controlled and safe tests with no real malware or risks to systems or data.

How often should phishing tests be conducted?

Depending on the company, industry, and requirements, regular simulations (e.g. semi-annually or annually) are recommended to sustainably strengthen awareness and promote lasting behavior change.

Can a phishing campaign be customized?

Yes, scenarios are tailored to the industry, company size, and typical attack patterns to achieve realistic results. This often requires a prior OSINT analysis.

What is phishing awareness training?

Phishing awareness training is a security measure in which employees learn to recognize and respond to various phishing attacks through targeted training sessions.

How do phishing tests support compliance and IT security?

They help companies review security policies, document awareness levels, and meet regulatory requirements such as NIS2, BSI, and ISO 27001.

Ready for your phishing test?

You know what your security policy looks like on paper. We'll show you how it holds up under real-world conditions.

Marc Lenze

IT-Security Business Development Lead

Marc Lenze

IT-Security Business Development Lead